From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 25 Jan 2006 09:57:46 +0200
Subject: [UNIX] Fetchmail Bouncing Message DoS
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060125092027.A868D582B@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Fetchmail Bouncing Message DoS
------------------------------------------------------------------------
SUMMARY
" <http://fetchmail.berlios.de/>; Fetchmail is a full-featured, robust,
well-documented remote-mail retrieval and forwarding utility intended to
be used over on-demand TCP/IP links (such as SLIP or PPP connections)."
fetchmail does not validate existed of email address, causing a DoS
condition when the program is crashed.
DETAILS
Vulnerable Systems:
* fetchmail version 6.3.1 and prior
* fetchmail version 6.3.2-rc3 and prior
Immune Systems:
* fetchmail version 6.3.2-rc4
* fetchmail version 6.3.2
Fetchmail contains a bug that causes itself to crash when bouncing a
message to the originator or to the local postmaster. The crash happens
after the bounce message has been sent, when fetchmail tries to free the
dynamic array of failed addresses, and calls the free() function with an
invalid pointer.
Vendor Status:
The vendor has issued a fix with fetchmail version 6.3.2 or a newer stable
release that can be downloaded from fetchmail's project site at
<http://developer.berlios.de/project/showfiles.php?group_id=1824>;
http://developer.berlios.de/project/showfiles.php?group_id=1824
The aged fetchmail 6.2.5.X branch is discontinued effective immediately.
No further releases from the 6.2.5.X branch will be made.
The new 6.3.X stable branch has been available since 2005-11-30 and will
not change except for bugfixes, documentation and message translations.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0321>;
CVE-2006-0321
Disclosure Timeline:
2006-01-19 - Internal review draft
2006-01-20 - Add CVE ID
2006-01-22 - Release 1.0
ADDITIONAL INFORMATION
The information has been provided by
<mailto:[email protected]> ma.
The original article can be found at:
<http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt>;
http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt
The bug report can be found at:
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747>;
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
